7 ms·

Teenage hacker became a legend attacking companies, then his rivals attacked him

105 points by fortran77 2y ago

neonate 2y ago
https://archive.ph/nupuG https://archive.ph/nupuG
AIFounder 2y ago
[flagged]
deleted 2y ago
[deleted]
smcin 2y ago
"GTA 6 Hacker Arion Kurtaj Became a Legend Attacking Companies. Then His Rivals Attacked Him." - WSJ (Newer headline, and useful for indexing the names)
A_D_E_P_T 2y ago
Article opens with: > The judge ultimately handed Kurtaj a sentence that his lawyers have called out of proportion with the crimes he stood accused of. The family declined to be interviewed. Doesn't actually mention what the sentence was until the end of the article: > The judge gave Kurtaj an indefinite hospital order—a sentence confining him to a secure mental-health ward until doctors and U.K. officials decide he is no longer a danger to the public. He was 18 years old. [. . .] People in Kurtaj’s situation can apply for a review of their detention once a year. Otherwise, their detention is subject to government review once every three years, according to the Ministry of Justice. > Kurtaj’s lawyers and some experts on autism have said a potential lifetime of incarceration isn’t appropriate for a teenager like Kurtaj. Thing is, there's basically a zero percent likelihood that it's actually a lifetime of incarceration. I haven't seen the statistics on this, but I'd bet that the average person incarcerated under such an order is out in a couple of years, and the vast majority are out within ten. What's more, it's not a prison. > It’s up to his doctors whether Kurtaj can access the internet. He was sent to a medium-security hospital ward, where in the common areas shared with other patients, he was surrounded by tablets, phones and computers. Come on, now. That sentence is neither as harsh (in terms of conditions) nor as draconian (in terms of duration) as the article wants us to feel. In the US, he be tried as an adult and he'd have it much worse... The punishment rarely fits the crime, but I think that the system did okay with this one.
- giantg2 2y ago
  If I (autistic) had something I was good at and made me not feel like human garbage I wouldn't stop doing it. It wouldn't surprise me if a company hires him. This is something he's good at, but just seems to need some direction and oversight.
- Firerouge 2y ago
  While there aren't many statistics on this sort of sentencing, I did find some here: https://forum.mentalhealthlaw.co.uk/t/section-37-41-data-specifically-regarding-tribunal-outcomes/ https://forum.mentalhealthlaw.co.uk/t/section-37-41-data-spe... And based on the following: > The number of admissions has fluctuated between 1,500 and 1,700 since 2008. And > The number of discharges and disposals has fluctuated between 1,350 and 1,550 since 2011 One can extrapolate that up to a couple hundred new admissions each year are staying in essentially indefinitely, as the discharge rate is generally always lower than the admissions rate.
- whimsicalism 2y ago
  Seems ridiculously disproportionate to be sentenced with no end date? Even if 'in practice' it usually ends after some amount of non-determinate time.
JanisErdmanis 2y ago
This will be controversial, but wouldn’t one be able to say there is a benefit to the society of having kids hacking systems, doing pranks, even collecting ransomware, and not fearing ridiculing their subjects in contrast to having national state attackers that harvest and sell secrets? The first type of attacker would pressure security to be taken seriously, whereas the second type of attack would rarely be noticed and disclosed.
- Denvercoder9 2y ago
  That's a false dichotomy. Having a few smart kids hack around doesn't end nation state attacks.
  - JanisErdmanis 2y ago
    They don't end nation-state attacks, but public exposure from teenagers hacking corporate computer systems can make them do their homework of fixing low-hanging vulnerabilities. As a result, the attacks from nation-state attackers could become more expensive.
    - tmpz22 2y ago
      Kids won't hack corporate systems. They'll hack each other, they'll hack and share nudes, they'll embarrass one another, harass, troll, and bully. I was a member of many video game communities as a kid and DDOS attacks to disrupt game play, RATs and other tools to steal and sell virtual currencies, happened frequent and often. I think the volume of destructive activities outweighs the constructive ones, even if many such perpetrators went on to become Software Engineers and Pen Testers for Meta, Google, and other companies. Like others I don't think they should be arrested for the less harmful examples - but there are lines that cause significant societal harm that should end in proportional punishments.
      - JanisErdmanis 2y ago
        The article mentions NVidia as an example of a ransomware attack. This seems to be a corporate threat. > I was a member of many video game communities as a kid and DDOS attacks I agree here that this is a destructive activity with no benefit. Securing games against DDOS attacks seems like a wasted effort.
ChumpGPT 2y ago
He was such a legend that they were able to catch him, monitor his online activity and his rivals were able to Doxx him. Did it not occur to this legend that concealing ones identity when breaking the law is an important step?
arealaccount 2y ago
I admittedly only grazed the article, but fighting back almost is what you desire as a teenage offensive hacker.
- know-how 2y ago
  [dead]
mmsc 2y ago
>He said the average age of anyone arrested for a crime in the U.S. is 37, while the average age of someone arrested for cybercrime is 19. Indeed. So why is it that these billion-valued-companies can so easily be hacked by teenagers? Who would win: a trillion dollar industry of cyber security, or a bunch of bored outcast teenagers?
- andsens 2y ago
  The reason the average age is so young is because they are the ones getting caught.
  - whimsicalism 2y ago
    No - I think it has much more to do with the fact that anyone smart enough to be doing this is going to be gainfully employed by the time they're an adult - but as an adolescent, you are bored, talented, and unrecognized - not a good combination. This is exactly my story and I doubt it is very unique.
    - namaria 2y ago
      What you mean no? That's exactly what GP said.
  - duped 2y ago
    I think it's more that older people are getting paid to do this work legally.
  - fortran77 2y ago
    It's like the airplane with the dots!
  - throw2024 2y ago
    Loosely agree with this, although greed can blur some people’s judgment
- trox 2y ago
  Because properly securing your systems is hard, especially if the attack surface is large. The attacker only needs to find a single weakness. Furthermore, you don't hear from all the teenagers trying to find vulnerabilities across the web, just when there's headlines.
jabuticaba 2y ago
Finally news about a hacker on hacker news
- d0mine 2y ago
  The word "Hacker" in Hacker News does not mean cracker https://en.wikipedia.org/wiki/Hacker_culture https://en.wikipedia.org/wiki/Hacker_culture
RobRivera 2y ago
Do people feel autism is an explanation for shitty behavior like posting sexually explicit images on internal company slack channels?
- labster 2y ago
  An explanation, sure. A justification, no. Just a reminder: the autism spectrum is wide, and two autistic people are likely to be more different from each other than a neurotypical person.
- autoexec 2y ago
  It sounds to me like that's more of a teenager trait than an autistic one. Not to say that every teenager would find humor in putting dicks in unexpected places, or even that only a teenager would, but it's pretty on brand for boys in that general age bracket. Teenagers are also biologically predisposed to occasionally making bad decisions. The kid in this article had a brain whose prefrontal cortex wouldn't finish developing for nearly another decade. I suspect that had a lot more to do with posting links to a penis in Uber's internal chats than autism did.
  - sulandor 2y ago
    > Teenagers are also biologically predisposed to occasionally making bad decisions. humans are
    - autoexec 2y ago
      True, but it's a lot worse for folks who haven't fully developed the part of their brain that is responsible for things like complex planning, impulse control, emotional regulation, logical thinking, the evaluation of risk and the awareness and careful consideration of long-term consequences. Not that I'm saying that teenagers can never do those things or that adults always will, but because their brains are still developing teenagers are, on average, going to make mistakes and take risks much more often than adults past their mid 20s, and that's without even taking into account the flood of hormones and the additional stress of adolescence. Making mistakes and taking risks is just a normal part of growing up, and some people feel that it's even advantageous for young adults to be prone to recklessness.
fefe23 2y ago
I'm sick and tired of the "the evil attacker attacked this harmless company" rhetoric. Take some responsibility for your actions! I loathe that you can apparently get away by telling reporters that it must have been a nation state actor. Oh it was just one kid in a hotel room? Well then he must have autism! Hey have you seen Rain Man? Yeah, must have been that kind of super power autism! It's revolting. Get your act together and stop blaming kids. If a kid can unlock your door by entering the Konami code on your door bell, that's on you.
- codezero 2y ago
  Locks are a social contract. We all know they can be bypassed, but doing so is illegal. Kids and adults should be held accountable for repeatedly breaking the law.
  - beeflet 2y ago
    computer security isn't comparable to physical security and should be held to a higher standard because it can be. When you expose a computer to a global computer network, you are exposing it to others with no shared social contract.
    - lmz 2y ago
      Well they should've picked a more "global" target then, not people who can get them caught.
    - codezero 2y ago
      He was prosecuted for the crime in the country he lived in under the social contract he was part of. Can you explain how his victims exposed themselves?
bookofjoe 2y ago
https://www.wsj.com/tech/cybersecurity/arion-kurtaj-hacker-468e6cad?st=EL9G3b&reflink=desktopwebshare_permalink https://www.wsj.com/tech/cybersecurity/arion-kurtaj-hacker-4...
Jyaif 2y ago
From what I gather from the article he's doing social engineering, not technical hacking. In other words: lying to, manipulating, and exploiting trusting folks, rather than finding technical flaws. Much less noble in my opinion.
- dmix 2y ago
  The what you do after social engineering and knowing what to ask for and pivot is very technical
- CatWChainsaw 2y ago
  In other words, all the things that politicians, CEOs, and Silicon Valley visionaries do?
opheliagreyw1 2y ago
[dead]
emmarh5 2y ago
[dead]
emmarh5 2y ago
[dead]

105 points by fortran77 2y ago

neonate 2y ago

https://archive.ph/nupuG https://archive.ph/nupuG

AIFounder 2y ago

[flagged]

deleted 2y ago

[deleted]

smcin 2y ago

"GTA 6 Hacker Arion Kurtaj Became a Legend Attacking Companies. Then His Rivals Attacked Him." - WSJ (Newer headline, and useful for indexing the names)

A_D_E_P_T 2y ago

Article opens with: > The judge ultimately handed Kurtaj a sentence that his lawyers have called out of proportion with the crimes he stood accused of. The family declined to be interviewed. Doesn't actually mention what the sentence was until the end of the article: > The judge gave Kurtaj an indefinite hospital order—a sentence confining him to a secure mental-health ward until doctors and U.K. officials decide he is no longer a danger to the public. He was 18 years old. [. . .] People in Kurtaj’s situation can apply for a review of their detention once a year. Otherwise, their detention is subject to government review once every three years, according to the Ministry of Justice. > Kurtaj’s lawyers and some experts on autism have said a potential lifetime of incarceration isn’t appropriate for a teenager like Kurtaj. Thing is, there's basically a zero percent likelihood that it's actually a lifetime of incarceration. I haven't seen the statistics on this, but I'd bet that the average person incarcerated under such an order is out in a couple of years, and the vast majority are out within ten. What's more, it's not a prison. > It’s up to his doctors whether Kurtaj can access the internet. He was sent to a medium-security hospital ward, where in the common areas shared with other patients, he was surrounded by tablets, phones and computers. Come on, now. That sentence is neither as harsh (in terms of conditions) nor as draconian (in terms of duration) as the article wants us to feel. In the US, he be tried as an adult and he'd have it much worse... The punishment rarely fits the crime, but I think that the system did okay with this one.

giantg2 2y ago
If I (autistic) had something I was good at and made me not feel like human garbage I wouldn't stop doing it. It wouldn't surprise me if a company hires him. This is something he's good at, but just seems to need some direction and oversight.
Firerouge 2y ago
While there aren't many statistics on this sort of sentencing, I did find some here: https://forum.mentalhealthlaw.co.uk/t/section-37-41-data-specifically-regarding-tribunal-outcomes/ https://forum.mentalhealthlaw.co.uk/t/section-37-41-data-spe... And based on the following: > The number of admissions has fluctuated between 1,500 and 1,700 since 2008. And > The number of discharges and disposals has fluctuated between 1,350 and 1,550 since 2011 One can extrapolate that up to a couple hundred new admissions each year are staying in essentially indefinitely, as the discharge rate is generally always lower than the admissions rate.
whimsicalism 2y ago
Seems ridiculously disproportionate to be sentenced with no end date? Even if 'in practice' it usually ends after some amount of non-determinate time.

JanisErdmanis 2y ago

This will be controversial, but wouldn’t one be able to say there is a benefit to the society of having kids hacking systems, doing pranks, even collecting ransomware, and not fearing ridiculing their subjects in contrast to having national state attackers that harvest and sell secrets? The first type of attacker would pressure security to be taken seriously, whereas the second type of attack would rarely be noticed and disclosed.

Denvercoder9 2y ago
That's a false dichotomy. Having a few smart kids hack around doesn't end nation state attacks.
- JanisErdmanis 2y ago
  They don't end nation-state attacks, but public exposure from teenagers hacking corporate computer systems can make them do their homework of fixing low-hanging vulnerabilities. As a result, the attacks from nation-state attackers could become more expensive.
  - tmpz22 2y ago
    Kids won't hack corporate systems. They'll hack each other, they'll hack and share nudes, they'll embarrass one another, harass, troll, and bully. I was a member of many video game communities as a kid and DDOS attacks to disrupt game play, RATs and other tools to steal and sell virtual currencies, happened frequent and often. I think the volume of destructive activities outweighs the constructive ones, even if many such perpetrators went on to become Software Engineers and Pen Testers for Meta, Google, and other companies. Like others I don't think they should be arrested for the less harmful examples - but there are lines that cause significant societal harm that should end in proportional punishments.
    - JanisErdmanis 2y ago
      The article mentions NVidia as an example of a ransomware attack. This seems to be a corporate threat. > I was a member of many video game communities as a kid and DDOS attacks I agree here that this is a destructive activity with no benefit. Securing games against DDOS attacks seems like a wasted effort.

ChumpGPT 2y ago

He was such a legend that they were able to catch him, monitor his online activity and his rivals were able to Doxx him. Did it not occur to this legend that concealing ones identity when breaking the law is an important step?

arealaccount 2y ago

I admittedly only grazed the article, but fighting back almost is what you desire as a teenage offensive hacker.

know-how 2y ago
[dead]

mmsc 2y ago

>He said the average age of anyone arrested for a crime in the U.S. is 37, while the average age of someone arrested for cybercrime is 19. Indeed. So why is it that these billion-valued-companies can so easily be hacked by teenagers? Who would win: a trillion dollar industry of cyber security, or a bunch of bored outcast teenagers?

andsens 2y ago
The reason the average age is so young is because they are the ones getting caught.
- whimsicalism 2y ago
  No - I think it has much more to do with the fact that anyone smart enough to be doing this is going to be gainfully employed by the time they're an adult - but as an adolescent, you are bored, talented, and unrecognized - not a good combination. This is exactly my story and I doubt it is very unique.
  - namaria 2y ago
    What you mean no? That's exactly what GP said.
- duped 2y ago
  I think it's more that older people are getting paid to do this work legally.
- fortran77 2y ago
  It's like the airplane with the dots!
- throw2024 2y ago
  Loosely agree with this, although greed can blur some people’s judgment
trox 2y ago
Because properly securing your systems is hard, especially if the attack surface is large. The attacker only needs to find a single weakness. Furthermore, you don't hear from all the teenagers trying to find vulnerabilities across the web, just when there's headlines.

jabuticaba 2y ago

Finally news about a hacker on hacker news

d0mine 2y ago
The word "Hacker" in Hacker News does not mean cracker https://en.wikipedia.org/wiki/Hacker_culture https://en.wikipedia.org/wiki/Hacker_culture

RobRivera 2y ago

Do people feel autism is an explanation for shitty behavior like posting sexually explicit images on internal company slack channels?

labster 2y ago
An explanation, sure. A justification, no. Just a reminder: the autism spectrum is wide, and two autistic people are likely to be more different from each other than a neurotypical person.
autoexec 2y ago
It sounds to me like that's more of a teenager trait than an autistic one. Not to say that every teenager would find humor in putting dicks in unexpected places, or even that only a teenager would, but it's pretty on brand for boys in that general age bracket. Teenagers are also biologically predisposed to occasionally making bad decisions. The kid in this article had a brain whose prefrontal cortex wouldn't finish developing for nearly another decade. I suspect that had a lot more to do with posting links to a penis in Uber's internal chats than autism did.
- sulandor 2y ago
  > Teenagers are also biologically predisposed to occasionally making bad decisions. humans are
  - autoexec 2y ago
    True, but it's a lot worse for folks who haven't fully developed the part of their brain that is responsible for things like complex planning, impulse control, emotional regulation, logical thinking, the evaluation of risk and the awareness and careful consideration of long-term consequences. Not that I'm saying that teenagers can never do those things or that adults always will, but because their brains are still developing teenagers are, on average, going to make mistakes and take risks much more often than adults past their mid 20s, and that's without even taking into account the flood of hormones and the additional stress of adolescence. Making mistakes and taking risks is just a normal part of growing up, and some people feel that it's even advantageous for young adults to be prone to recklessness.

fefe23 2y ago

I'm sick and tired of the "the evil attacker attacked this harmless company" rhetoric. Take some responsibility for your actions! I loathe that you can apparently get away by telling reporters that it must have been a nation state actor. Oh it was just one kid in a hotel room? Well then he must have autism! Hey have you seen Rain Man? Yeah, must have been that kind of super power autism! It's revolting. Get your act together and stop blaming kids. If a kid can unlock your door by entering the Konami code on your door bell, that's on you.

codezero 2y ago
Locks are a social contract. We all know they can be bypassed, but doing so is illegal. Kids and adults should be held accountable for repeatedly breaking the law.
- beeflet 2y ago
  computer security isn't comparable to physical security and should be held to a higher standard because it can be. When you expose a computer to a global computer network, you are exposing it to others with no shared social contract.
  - lmz 2y ago
    Well they should've picked a more "global" target then, not people who can get them caught.
  - codezero 2y ago
    He was prosecuted for the crime in the country he lived in under the social contract he was part of. Can you explain how his victims exposed themselves?

bookofjoe 2y ago

https://www.wsj.com/tech/cybersecurity/arion-kurtaj-hacker-468e6cad?st=EL9G3b&reflink=desktopwebshare_permalink https://www.wsj.com/tech/cybersecurity/arion-kurtaj-hacker-4...

Jyaif 2y ago

From what I gather from the article he's doing social engineering, not technical hacking. In other words: lying to, manipulating, and exploiting trusting folks, rather than finding technical flaws. Much less noble in my opinion.

dmix 2y ago
The what you do after social engineering and knowing what to ask for and pivot is very technical
CatWChainsaw 2y ago
In other words, all the things that politicians, CEOs, and Silicon Valley visionaries do?

opheliagreyw1 2y ago

[dead]

emmarh5 2y ago

[dead]

emmarh5 2y ago

[dead]